Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfSense 2.1 build 20130911-1816 - Directory Traversal

    Russian
    1
    1
    687
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pf007
      last edited by

      копипаста  http://ru.1337day.com/exploit/21827
      <authenticated users="" with="" only="" permission="" to="" access="" some="" packages="" in="" web="" gui<br="">(a.k.a. webConfigurator) will be able to escalate themselves to other
      privileged admin by reading /conf/config.xml file through bugs (i.e. Snort
      LFI), result in fully compromise the pfSense.

      This attack abuse the user privilege scheme with some of official packages
      (System > Package Manager)

      • Session Hijacking also possible to steal less privileged user sessions to
        perform this trick  due to "http" admin by default webConfigurator.></authenticated>
      1 Reply Last reply Reply Quote 0
      • First post
        Last post